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On-orbit refueling of spacecraft has been proposed as an alternative to the exclusive use 
of Heavy-lift Launch Vehicles to enable human exploration beyond Low Earth Orbit (LEO). 
In these scenarios, beyond LEO spacecraft are launched dry (without propellant) or 
partially dry into orbit, using smaller or fewer element launch vehicles. Propellant is then 
launched into LEO on separate launch vehicles and transferred to the spacecraft. Refueling 
concepts are potentially attractive because they reduce the maximum individual payload 
that must be placed in Earth orbit. However, these types of approaches add significant 
complexity to mission operations and introduce more uncertainty and opportunities for 
failure to the mission. In order to evaluate these complex scenarios, the authors developed a 
Monte Carlo based discrete-event model that simulates the operational risks involved with 
such strategies, including launch processing delays, transportation system failures, and on- 
orbit element lifetimes. This paper describes the methodology used to simulate the mission 
risks for refueling concepts, the strategies that were evaluated, and the results of the 
investigation. The results of the investigation show that scenarios that employ refueling 
concepts will likely have to include long launch and assembly timelines, as well as the use of 
spare tanker launch vehicles, in order to achieve high levels of mission success through 
Trans Lunar Injection. 
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I. Introduction 

A S part of NASA’s support of the 2009 Review of U.S. Human Space Flight Plans Committee 1 options, a 
detailed analysis was undertaken to examine the viability of refueling spacecraft in Low Earth Orbit (LEO) 
using some form of on-orbit propellant refueling strategy. This approach is attractive because it allows a greater 
fraction of the mass delivered to LEO to be dedicated to the spacecraft and its associated payload, rather than to 
propellant. This would allow for increased overall mission performance using a given launch vehicle and/or 
potentially could eliminate the need to develop a new heavy-lift launch capability to support exploration. 
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Rather than having to launch transportation elements fully fueled, on-orbit refueling allows those elements to be 
launched dry, at only a fraction of the total fueled mass. Propellant is then launched on one or more additional 
launch vehicles and transferred to the element in Low Earth Orbit (LEO) 2 . 

While the refueling concept is attractive from a performance perspective, there are questions concerning the 
integrated reliability of such a system from an overall operational perspective. To address these concerns, the 
authors completed an effort to look at the mission-level risks involved with such strategies, including risks 
associated with launch delays, transportation system failures, and on-orbit system lifetimes. A Monte Carlo based 
discrete-event simulation model was developed to evaluate each failure type for various refueling strategies and to 
develop overall probabilities of mission failure for each. Finally, these failure probabilities were compared to those 
for the proposed NASA Constellation architecture 3 . 

This paper describes in Section 2 the concept of operations for on-orbit refueling. Section 3 describes the 
complexities and risks in these strategies. The methodology used to evaluate the mission risks for refueling systems 
are discussed in Section 4. Section 5 addresses the strategies that were evaluated. The results of the investigation are 
discussed in Section 6 and some conclusions and forward work are presented in Section 7. 

II. Concept of Operation for On-Orbit Refueling 

The simulation model that is described in this paper was designed to evaluate a broad range of possible refueling 
and depot strategies, as well as a range of possible exploration destinations. For the purposes of demonstrating the 
operation of the simulation model and the resulting analysis, one specific concept of operations is detailed in this 
paper. This particular concept is designed to support human lunar landing missions and involves the launch of a non- 
fueled (empty) Earth Departure Stage (EDS) into LEO. The basic concept of operations is shown in Figure 1. 

In this concept a dry EDS is first launched into LEO. Some number of propellant carrying and refueling vehicles 
[X] are then launched serially into orbit where autonomous rendezvous and docking (ARD) with the EDS is 
performed. Propellant is transferred into the EDS from each refueling vehicle. When the EDS has been fully fueled, 
a Lunar Lander and a Crewed vehicle are then launched separately and rendezvous and dock with the EDS. The 
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Figure 1. EDS Refueling Concept of Operations 
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entire stack, including the EDS, Lander, and Crew Module are propelled to the Moon by the EDS. In this concept, 
the EDS acts as the on-orbit fuel depot 4,5 . This is attractive because no permanent on-orbit depot is required to 
collect and distribute fuel. 

III. Complexities and Risks in On-Orbit Refueling Strategies 

The general drawback of on-orbit refueling scenarios is that they require a greater number of launches to place 
the elements and propellant in orbit, as compared to launching fully fueled vehicles. The additional launches add to 
the complexity of operations and potentially increase the risk to the overall mission. 

In the on-orbit refueling strategy described above, it is anticipated that, using an Evolved Expendable Launch 
Vehicle (EELV) with the capability to deliver 25 metric tons of payload to LEO, it would take between 5 and 10 
planned launches to supply the required amount of propellant to orbit. The actual number of required tanker flights 
will depend on the desired capacity to the lunar surface and the propellant boil-off rate that can be achieved on-orbit. 
Such a large number of launches will add a significant amount of complexity and uncertainty to mission operations, 
and increases the opportunities for overall mission failure. 

There are two primary areas of risk that are of concern in this scenario. The first is the large number of 
opportunities for mission failure. In the scenario described in Figure 1, if 8 refueling flights are required, then a total 
of 11 Earth to LEO launches are required, along with ten rendezvous and docking events, and eight propellant 
transfer events. Each of these events has the potential to disrupt the overall mission. Although each individual event 
may be accomplished with high reliability, the total number of events could still result in a relatively low overall 
mission reliability. 

The second major area of risk involves the orbital lifetime limit of the system. The period over which the EDS 
can remain in LEO will be limited by several factors; the design lifetime of the element, the rate at which propellant 
will boil-off while in orbit, and the risk associated with micrometeorite and orbital debris (MMOD). Because of 
these factors there will be some restricted period of time in which all of the planned launches must take place. The 
lifetime of the EDS for a lunar mission can theoretically be extended a significant amount; however, this would 
involve added complexity, mass, and cost. 

One option for reducing the overall mission risk is to include into the concept of operations the possibility of 
attempting to re-fly any tanker flights that fail during the launch and refueling process. Because of the number of 
tanker flights, a major portion of the overall mission risk is involved with failure to launch, rendezvous, or transfer 
propellant on one of these flights. Since these flights are rather generic in nature, it is possible to simply have extra 
launchers and spacecraft available and ready to fly. In the event that one or more of these flights is a failure, a 
backup can be launched to complete fueling, avoiding the failure of the overall mission. It is assumed that there is no 
option to re-fly any of the other three missions; the EDS, the Lunar Lander, or the Crew Module in the event of an 
unwanted incident. These flights involve unique elements and the loss of any one of them results in failure of the 
overall mission. While the ability to re-fly tanker flights may lead to fewer overall technical failures, this option 
actually increases the chance of EDS on-orbit lifetime failure. Any tanker re-flights that occur will stretch out the 
overall launch schedule, increasing the probability that the EDS on-orbit lifetime will be exceeded. In addition, the 
cost of having extra tanker flights constantly available for use could be considerable. 

IV. Simulation Models 

The complexities that are described for on-orbit refueling scenarios make it difficult to analyze the overall 
mission level of reliability. There are many 
elements that need to work together to be 
successful in this scenario, and failures in any of 
the elements have feedbacks that cause delays or 
failures in other elements. 

The simulation models that were used to 
evaluate refueling scenarios involve two 

components: 

• Orbital Refueling Model (ORM) 

• Manifest Assessment Simulation 

Technique (MAST) 

These two components work in an iterative 
manner to evaluate launch and orbital operations 
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for a variety of launch concepts. Figure 2 details the basic operation of the simulation. 

The Orbital Refueling Model (ORM) is a Monte Carlo model that evaluates the performance and reliability of 
the overall operations. The ORM has a flexible interface that allows missions and operations to be interactively 
structured. Using this interface, options for the number of launches, vehicles types, and scope of operations are 
defined. Probability distributions for operational reliability of each mission phase are also defined within the model. 
The ORM then specifically simulates each event in the overall concept of operations, including the outcome based 
on the input reliability distributions, and possible delays. 

The ORM structure for the concept described in this paper is shown in Figure 3. In the proposed concept of 
operations, the first launch is of the EDS. If this launch is a success, then the EDS is placed in orbit and the re- 
fueling process begins. If the launch is a failure, then the overall mission fails. Following the EDS launch, a series of 
tanker flights are launched. The number of planned tanker flights is an input to the model. Each tanker launches, 
rendezvous with the EDS and transfers propellant in series. Each flight can fail on launch, rendezvous, or transfer. If 
a tanker flight fails, additional replacement flights can be attempted, if that option is selected in the model. If all 
tanker flights are successfully completed, then the model moves to the next stage. If the maximum number of tanker 
flight attempts is reached before the required number of tanker flights has been successfully achieved, then the 
overall mission fails. If all tanker missions are successfully completed, the Lunar Lander and Crew Module are then 
launched in series. Each of these flights is critical; if they fail in any part of the operations the overall mission fails. 

In addition to the technical success for each event, the ORM also simulates and tracks the schedule for each 
successive event. The EDS has a limited lifetime, which starts when the element successfully reaches orbit. If, in a 
given run, all other required launches are not completed within the defined EDS lifetime, the overall mission is 
considered a failure. 

Results of the ORM simulation are integrated across Monte Carlo runs to produce a distribution for the overall 
probability of success for the mission concept. The metric represents the overall probability that a fully fueled EDS, 
Lander, and Crew Module will be assembled in LEO and then proceed to Trans Lunar Injection (TLI). 

Probability distributions for the schedule of each launch event evaluated in ORM are developed using the other 
component of the simulation - MAST. MAST is a discrete event simulation (DES) model, built using Arena by 
Rockwell Automation, which evaluates the launch and processing operations for each launch in a sequence and the 
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interactions between launches. ORM feeds MAST 
data for each planned launch in a given run, 
including a nominal schedule and delays imposed 
by failures. MAST takes that data and, based upon 
the results of its launch countdown simulation, 
feeds back a probability distribution for the 
achieved launch date for each launch. 

The scope of MAST includes all of the 
processes shown in Figure 4. For this assessment 
we assumed that all launch vehicles are in a state of 
readiness (ready to begin launch countdown) when 
we commit to launch of the EDS. The practicality 
of this assumption was not addressed by our 
analysis. Launch countdowns are modeled using a 
cyclical event construct that matches the nature of 
launch vehicle countdowns 5 6 . There are discrete 
points in time in which decisions are made to 
continue on with the launch countdown or declare 
a launch delay of 1 or more days. These include a 
launch minus 2 days review, a launch minus 1 day review, a Mission Management Team (MMT) decision to 
proceed with propellant fueling, the propellant fueling operations, the post fueling operations including astronaut 
ingress into the space vehicle if appropriate, an MMT decision to launch, a terminal countdown controlled by a 
ground launch sequencer, and an engine start sequence. 

Depending upon when a delay is declared will, at least in part, determine where one will recycle back to in the 
countdown for the next attempt. For example, delays that occur after fueling has been initiated will have to recycle 
at least back to the MMT fueling decision point. The magnitude of the delay is dependent upon the initiating cause 
of the delay. For example, weather delays tend to be one day, whereas flight hardware delays tend to be more than 
one day. 

Delay probabilities and durations are based on an analysis of historical analogs. Complete history files of launch 
countdowns for various vehicle types, including information on every launch delay (i.e., when the delay occurred, its 
reason, its duration, and where the countdown was re-entered for the next attempt) were evaluated in order to 
produce this data. If existing vehicles are used in the simulations, these datasets are directly used in the simulation. 

If new proposed launch vehicles are used in the simulation, flight hardware launch delay probabilities and 
duration estimates are developed by decomposing the vehicles into their major components. This allows the ability 
to take into consideration the quantity and complexity of the flight hardware relative to the space shuttle and other 
vehicles in the database 7,8 . 



Figure 4. Scope of MAST Simulation 


V. Cases 

Using the simulation models described above, the overall reliability of the EDS re-fueling concept was 
evaluated. Several variables and their impact on overall mission reliability were evaluated as part of this effort. 
Those variables were: 

1 . Number of Propellant Flights - The primary variable in this analysis is the number of tanker flights that are 

required to deliver propellant to the EDS. As part of this analysis, the number of flights was varied from 
zero to ten. The number of flights actually required will vary based on the desired cargo capacity landed on 
the moon and the achieved boil-off rate for propellant. For a capacity similar to that provided by the 
proposed Constellation architecture, it is anticipated that eight flights will be required. While at least one 
planned tanker flight will always be required to support this specific scenario, the zero tanker case was 
included in this analysis, because the results for that case will be representative of the reliability of a system 
in which a permanent on-orbit fueling depot is used (because in that case as many tanker flights as are 
required to deliver propellant could be launched prior to the launch of the EDS). 

2. Launch Reliability of the Propellant Launch System - The second variable is the launch reliability of the 

launch system used to supply propellant to the EDS. For this analysis, launch reliabilities of 0.90, 0.95, and 
0.985 were investigated. These reliabilities span the estimated range of expected reliability from new launch 
systems through matured launch systems. 
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3. EDS Lifetime - The third major variable is the EDS LEO lifetime. This is the total time that the EDS can 

spend on orbit prior to TLI before the system fails. For this analysis on-orbit lifetimes of 30, 60, 90, and 120 
days were investigated. 120 days is considered to be the practical limit from a technical standpoint. In 
addition, beyond that point, the MMOD risk outweighs any gains in lifetime risk. 

4. Number of Available Spare Tanker Flights - The fourth variable that was analyzed was the number of 

spare tanker flights that are available and ready to fly. For this analysis, values of 0, 1, and 2 were evaluated. 
Two spare tanker launches covers almost all reasonable loss scenarios. 

5. Reliability of the Automated Rendezvous, Docking, and Propellant Transfer - A range of reliabilities 

was evaluated for the on-orbit activities of each propellant refueling flight. A range of ARD and Transfer 
reliabilities from 0.95 to 0.99 were evaluated. 

6. Availability of Ground Processing and Launch Infrastructure for Refueling Flights - The results of the 

MAST simulation are heavily influenced by the assumed availability of ground processing and launch 
infrastructure, particularly the number of available launch pads. For this analysis two independent cases 
were evaluated for propellant vehicle launch pad availability. The first case assumed that all propellant 
vehicles would be launched from Cape Canaveral and that there would be three launch pads available for the 
propellant flights. This was referred to as the ‘constrained’ case. The other case, referred to as the 
‘unconstrained’ case, assumed that propellant vehicles could be launched from any site world-wide and that 
there was no limit on the number of available launch pads. 

For the cases detailed in this paper, certain other parameters were held constant. The most significant is the 
launch reliability for each of the three dedicated hardware flights (i.e., EDS, Lunar Lander, and Crew Module), 
which was assumed to be 0.985. 


VI. Results 

The overall probability that a mission would reach TLI is the main output metric of interest for the simulation. 
Failure to reach TLI included all potential failure modes, including hardware failures and EDS on-orbit lifetime 
failures. This metric also accounted for the possibility of re-flying failed tanker flights. 

Initial analysis of results showed that four of the six variables described above had a primary impact on the 
overall system reliability. Those variables were: the Number of Propellant Flights, the Launch Reliability of the 
Propellant Launch System, the EDS Lifetime, and the Number of Available Spare Tanker Flights. The impact of 
these variables on reliability is discussed below. The impact of the other two variables, the Reliability of the 
Automated Rendezvous, Docking and Fueling and the Availability of Launch Infrastructure, were found to have 
only a relatively minor impact on the overall reliability. The results discussed in this paper are limited to changes in 
the primary variables. Results for all cases shown below assume that the ARD & Refueling reliability is 0.985 and 
that the ground and launch infrastructure is the ‘Constrained’ case. 

The basic results for this metric across all runs are shown in Figures 5-7. Figure 5 show results for cases with 
zero available spare tanker flights. Figure 6 shows results for cases with a single spare tanker flight available. Figure 
7 shows results for cases with two spare tanker flights available. In each figure a number of lines are shown to 
indicate the system reliability across the range of potential number of tanker flights. Individual lines are shown for 
different combinations of EDS lifetime and propellant launch system reliability. 

The results of the simulation indicate that, in order to achieve overall mission reliabilities that are even close to 
the Heavy-lift Launch Vehicle (HLV) solutions, a refueling operation will have to employ an EDS with a long on- 
orbit lifetime and will likely have to allow for replacement tanker flights. Each of the variables evaluated in this 
analysis are significant contributors to overall system reliability through TLI. For comparative purposes the overall 
reliability to TLI of the Constellation architecture is projected to be approximately 0.89. 

The number of tanker flights that are required is one of the primary drivers of overall system reliability, 
particularly at lower value of launch reliability. However, for a given class of launch vehicle the number of tankers 
will be dictated by the required amount of propellant. It is anticipated that employing a 25metric ton class launch 
vehicle, that between seven and nine tanker flights would be required to enable a lunar mission with a capacity 
similar to that provided by the Constellation architecture. 
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Overall Probability of Launch and Rendezvous Success 
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Figure 5. Simulation Results for 0 Available Tanker Refly Attempts 


Overall Probability of Launch and Rendezvous Success 
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Figure 6. Simulation Results for 1 Available Tanker Refly Attempt 
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Overall Probability of Launch and Rendezvous Success 
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Figure 7. Simulation Results for 2 Available Tanker Refly Attempts 


The second major contributor to overall system reliability is the availability of launch-on-need spare tanker 
flights to replace tanker flights that fail launch, rendezvous, docking, or propellant transfer. For the case referenced 
above with eight tanker flights and a tanker launch reliability of 0.985, at a 120-day EDS lifetime, the availability of 
a single spare tanker increases the overall reliability from 0.64 to 0.82. A second spare tanker flight further increases 
the overall reliability to 0.85. At lower levels of tanker vehicle launch reliability the impact of spare tanker flights is 
even more pronounced. For the same case with tanker launch reliability of 0.90, the overall system reliability with 
no spare tankers is 0.31. A single spare flight increases the reliability to 0.60 and a second spare to 0.76. 

The reliability of the tanker launch system is a major contributor to overall reliability, if no spare tanker flights 
are available. In this case the reliability of the tanker is critical because a failure in any single flight leads to overall 
system failure. When spare tankers are available, however, the impact of tanker launch reliability is reduced, since 
any given flight can be replaced in the event of a failure. 

In order to approach the reliability projected for the Constellation system, both a long EDS on-orbit lifetime and 
spare tanker flights will have to be employed. With eight tanker launches and a tanker launch reliability of 0.985, if 
there is a 120-day EDS lifetime and one spare tanker flight, the projected reliability through TLI is 0.82. This is 
comparable to the projected Constellation reliability of 0.89. 

VII. Forward Work & Conclusion 

There are several extensions to the current model that are being developed to further support the analysis of 
propellant refueling concepts. One area of interest is the analysis of the reliability of permanent, on-orbit propellant 
refueling depots. This concept has the ability to reduce some of the risks described in this paper but could have 
significantly larger costs. Another area of development involves the extension of the MAST model to include 
manufacturing constraints. The infrastructure for EELV manufacturing is limited and delays in the availability of 
launch vehicles could have a major impact of refueling concepts. Finally, significant work is currently being 
conducted to extend the reliability analysis of on-orbit refueling concepts to include MMOD risk and the risk of on- 
orbit system failure. Evaluation of these risks is critical since one of the primary findings in the current analysis is 
that long on-orbit system lifetimes will be required to support refueling concepts. 
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Since the analysis described in this paper was completed in support of the Augustine Commission 1 , the tools that 
are described have been used to further support analysis of potential architectures. In particular, the tools have been 
used as part of the ‘Human Exploration Framework Team (HEFT)’ effort to evaluate possible implementations of 
the “Flex-Path” architecture and to inform future national space policy. Propellant refueling scenarios are a major 
focus of current analysis and the evaluation of the reliability of those scenarios will be important in establishing a 
future direction for human space flight. 

In order to achieve reliabilities that approach those for the exclusively HLV-based architecture, the EDS on-orbit 
lifetime will have to be as long as possible. In the results of this analysis, any periods of less than 120 days resulted 
in poor overall reliability. In addition, in order to approach HLV-based reliability, there will likely have to be some 
possibility of re-flying lost tanker flights. Allowing a single replacement flight significantly increased the overall 
reliability. Adding a second flight did not have as dramatic an effect. However, a second flight was required to 
achieve reliabilities that were close to the HLV architecture. It is possible that the overall mission reliability could be 
increased without replacement flights, if the tanker launch reliability could be significantly increased. However, a 
significant improvement in reliability is likely to require a more advanced launch vehicle. 

The results presented in this paper represent the performance of a refueling concept using an EDS as the 
propellant depot for a lunar mission. Other concepts, such as a permanent on-orbit propellant depot may have 
significantly different mission reliabilities. In addition, the use of propellant refueling for missions to other 
destinations may result in very different reliabilities. The simulation models described in this paper have the 
capability of evaluating and comparing the reliability of these alternate scenarios. 
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